Repository navigation

CI/CD Pipeline #4

Workflow file for this run

	name: CI/CD Pipeline

	on:
	push:
	branches: [ main, develop, claude/** ]
	pull_request:
	branches: [ main, develop ]
	schedule:
	- cron: '0 0 * * 0' # Weekly security scan

	env:
	PYTHON_VERSION: '3.11'
	DOCKER_REGISTRY: ghcr.io
	IMAGE_NAME: synthoraai/llm-finetuning-lab

	jobs:
	security-scan:
	name: Security Scanning
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'sarif'
	output: 'trivy-results.sarif'

	- name: Upload Trivy results to GitHub Security
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: 'trivy-results.sarif'

	- name: Run Bandit security linter
	run: \|
	pip install bandit[toml]
	bandit -r src/ -f json -o bandit-report.json \|\| true

	- name: Check dependencies for known vulnerabilities
	run: \|
	pip install safety
	safety check --json \|\| true

	code-quality:
	name: Code Quality & Linting
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Cache pip packages
	uses: actions/cache@v4
	with:
	path: ~/.cache/pip
	key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
	restore-keys: \|
	${{ runner.os }}-pip-

	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install black flake8 isort mypy pylint

	- name: Run Black
	run: black --check src/ scripts/ tests/

	- name: Run Flake8
	run: flake8 src/ scripts/ tests/ --max-line-length=120 --exclude=__pycache__,venv

	- name: Run isort
	run: isort --check-only src/ scripts/ tests/

	- name: Run Pylint
	run: pylint src/ --fail-under=8.0 \|\| true

	- name: Run MyPy type checking
	run: mypy src/ --ignore-missing-imports \|\| true

	test:
	name: Test Suite
	runs-on: ${{ matrix.os }}
	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-latest, macos-latest, windows-latest]
	python-version: ['3.9', '3.10', '3.11', '3.12']
	exclude:
	- os: macos-latest
	python-version: '3.9'
	- os: windows-latest
	python-version: '3.9'

	steps:
	- uses: actions/checkout@v4

	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}

	- name: Cache pip packages
	uses: actions/cache@v4
	with:
	path: ~/.cache/pip
	key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}

	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -r requirements.txt
	pip install pytest pytest-cov pytest-asyncio pytest-xdist

	- name: Run unit tests
	run: \|
	pytest tests/ -v -m "not slow and not gpu" --cov=src --cov-report=xml --cov-report=term-missing -n auto

	- name: Run integration tests
	run: \|
	pytest tests/ -v -m "integration" --cov=src --cov-append --cov-report=xml

	- name: Upload coverage to Codecov
	uses: codecov/codecov-action@v4
	with:
	file: ./coverage.xml
	flags: unittests
	name: codecov-${{ matrix.os }}-py${{ matrix.python-version }}
	fail_ci_if_error: false

	test-gpu:
	name: GPU Tests
	runs-on: ubuntu-latest
	if: github.event_name == 'push' && github.ref == 'refs/heads/main'
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Install dependencies
	run: \|
	pip install -r requirements.txt
	pip install pytest

	- name: Run GPU tests (simulation)
	run: \|
	pytest tests/ -v -m "gpu" \|\| echo "GPU tests skipped (no GPU available)"

	build-and-push-docker:
	name: Build & Push Docker Image
	runs-on: ubuntu-latest
	needs: [security-scan, code-quality, test]
	if: github.event_name == 'push' && (github.ref == 'refs/heads/main' \|\| github.ref == 'refs/heads/develop')
	permissions:
	contents: read
	packages: write

	steps:
	- uses: actions/checkout@v4

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Log in to Container Registry
	uses: docker/login-action@v3
	with:
	registry: ${{ env.DOCKER_REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Extract metadata
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
	tags: \|
	type=ref,event=branch
	type=sha,prefix={{branch}}-
	type=semver,pattern={{version}}
	type=semver,pattern={{major}}.{{minor}}

	- name: Build and push Docker image
	uses: docker/build-push-action@v5
	with:
	context: .
	push: true
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	cache-from: type=gha
	cache-to: type=gha,mode=max
	platforms: linux/amd64,linux/arm64

	- name: Scan Docker image for vulnerabilities
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
	format: 'sarif'
	output: 'trivy-image-results.sarif'

	deploy-staging:
	name: Deploy to Staging
	runs-on: ubuntu-latest
	needs: [build-and-push-docker]
	if: github.ref == 'refs/heads/develop'
	environment:
	name: staging
	url: https://staging.synthoraai.com

	steps:
	- uses: actions/checkout@v4

	- name: Deploy to staging
	run: \|
	echo "Deploying to staging environment..."
	# Add actual deployment commands here

	deploy-production:
	name: Deploy to Production
	runs-on: ubuntu-latest
	needs: [build-and-push-docker]
	if: github.ref == 'refs/heads/main'
	environment:
	name: production
	url: https://synthoraai.com

	steps:
	- uses: actions/checkout@v4

	- name: Deploy to production
	run: \|
	echo "Deploying to production environment..."
	# Add actual deployment commands here

	- name: Create GitHub Release
	uses: actions/create-release@v1
	if: startsWith(github.ref, 'refs/tags/')
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	tag_name: ${{ github.ref }}
	release_name: Release ${{ github.ref }}
	draft: false
	prerelease: false

	performance-test:
	name: Performance Testing
	runs-on: ubuntu-latest
	needs: [test]
	if: github.event_name == 'push'

	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Install dependencies
	run: \|
	pip install -r requirements.txt
	pip install pytest pytest-benchmark

	- name: Run performance benchmarks
	run: \|
	pytest tests/ -v -m "benchmark" --benchmark-only \|\| true

	documentation:
	name: Build Documentation
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Install dependencies
	run: \|
	pip install mkdocs mkdocs-material

	- name: Build documentation
	run: \|
	mkdocs build --strict

	- name: Deploy documentation
	if: github.ref == 'refs/heads/main'
	run: \|
	mkdocs gh-deploy --force

Navigation Menu

Repository navigation

CI/CD Pipeline #4

Workflow file

CI/CD Pipeline #4

Uh oh!

Workflow file for this run